Description
PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.2 - Session.Save_Path() 'Safe_mode' / 'open_basedir' Restriction Bypass EDB-29239 · local · Dec 8, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 24022 third-party-advisory
- OpenPKG-SA-2007.010 vendor-advisory
- 20061208 PHP 5.2.0 session.save_path safe_mode and open_basedir bypass mailing-list
- 24514 third-party-advisory
- 2000 third-party-advisory
- http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.7&r2=1.336.2.53.2.8
- MDKSA-2007:038 vendor-advisory
- 20061208 PHP 5.2.0 session.save_path safe_mode and open_basedir bypass third-party-advisory
- SUSE-SA:2007:020 vendor-advisory
- 21508 vdb-entry